Acorus
2 Kwiecień 2012 15:48
#2
Odinstaluj Astroburn Toolbar.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:
:OTL IE - HKU\S-1-5-21-1853609065-2552516797-1620708522-1000…\SearchScopes{5F970FDE-702B-4ef9-920C-5F2848A5AF26}: “URL” = http://www.astroburn-search.com/search/web?q={searchTerms} FF - prefs.js…keyword.URL: “http://startsear.ch/?q= ” [2011/05/29 16:27:37 | 000,000,000 | —D | M] (“Astroburn Toolbar”) – C:\Users\Mirek\AppData\Roaming\mozilla\Firefox\Profiles\6xi63meo.default\extensions\AstroToolbar@toolbarnet.com [2011/05/29 16:27:21 | 000,002,071 | ---- | M] () – C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\6xi63meo.default\searchplugins\absearch-search.xml [2011/09/18 15:36:48 | 000,001,565 | ---- | M] () – C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\6xi63meo.default\searchplugins\web-search.xml O3:64bit: - HKLM…\Toolbar: (Astroburn Toolbar) - {EFEED92A-A33D-4873-BA8F-32BAA631E54D} - C:\Program Files (x86)\Astroburn Toolbar\ABToolbar64.dll () O3:64bit: - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM…\Toolbar: (Astroburn Toolbar) - {EFEED92A-A33D-4873-BA8F-32BAA631E54D} - C:\Program Files (x86)\Astroburn Toolbar\ABToolbar.dll () O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3:64bit: - HKU\S-1-5-21-1853609065-2552516797-1620708522-1000…\Toolbar\WebBrowser: (Astroburn Toolbar) - {EFEED92A-A33D-4873-BA8F-32BAA631E54D} - C:\Program Files (x86)\Astroburn Toolbar\ABToolbar64.dll () O3 - HKU\S-1-5-21-1853609065-2552516797-1620708522-1000…\Toolbar\WebBrowser: (Astroburn Toolbar) - {EFEED92A-A33D-4873-BA8F-32BAA631E54D} - C:\Program Files (x86)\Astroburn Toolbar\ABToolbar.dll () O4 - HKU\S-1-5-21-1853609065-2552516797-1620708522-1000…\Run: [Antivirus Protection] “C:\Users\Mirek\AppData\Roaming\Antivirus Protection\AntivirusProtection2012.exe” /STARTUP File not found O4 - HKU\S-1-5-21-1853609065-2552516797-1620708522-1000…\Run: [Antivirus Protection 2012 SH] C:\Users\Mirek\AppData\Roaming\Antivirus Protection\securityhelper.exe File not found O4 - HKU\S-1-5-21-1853609065-2552516797-1620708522-1000…\Run: [Antivirus Protection 2012 SM] C:\Users\Mirek\AppData\Roaming\Antivirus Protection\securitymanager.exe File not found O4 - HKU\S-1-5-21-1853609065-2552516797-1620708522-1000…\Run: [ares] “C:\Program Files (x86)\Ares\Ares.exe” -h File not found O4 - HKU\S-1-5-21-1853609065-2552516797-1620708522-1000…\Run: [EPSON SX210 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFDE.EXE /FU “C:\Windows\TEMP\E_SF891.tmp” /EF “HKCU” File not found O4 - HKU\S-1-5-21-1853609065-2552516797-1620708522-1000…\Run: [uvp0kgurd5wt] C:\Users\Mirek\AppData\Local\Temp\176109.exe File not found [2012/04/02 16:04:12 | 000,000,000 | —D | C] – C:\Users\Mirek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antivirus Protection [2012/04/02 17:01:43 | 000,000,306 | ---- | M] () – C:\Windows\tasks\QVIGJCC.job [2012/03/13 16:20:14 | 000,089,088 | RHS- | C] () – C:\Windows\SysWow64\kbdnecnt7.dll [2011/12/13 18:05:36 | 000,000,000 | —D | M] – C:\Users\Mirek\AppData\Roaming\OpenCandy :Commands [emptytemp]
Kliknij Wykonaj skrypt.Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).
Pokaż nowy log OTL.txt oraz raport z usuwania.
Acorus
2 Kwiecień 2012 16:22
#4
W OTL użyj opcji Sprzątanie.Zainstaluj aktualizacje do programow wskazanych przez: http://screen317.spywareinfoforum.org/SecurityCheck.exe jako out of date.
Już wszystko zrobiłem. Dziękuje za pomoc.